Provisional text
OPINION OF ADVOCATE GENERAL
ĆAPETA
delivered on 14 September 2023(1)
Case C‑115/22
SO
joined parties:
Nationale Anti-Doping Agentur Austria GmbH (NADA),
Österreichischer Leichtathletikverband (ÖLV),
World Anti-Doping Agency (WADA)
(Request for a preliminary ruling from the Unabhängige Schiedskommission (Independent Arbitration Committee, Austria))
(Reference for a preliminary ruling – Article 267 TFEU – Definition of ‘court or tribunal’ – Reference from a national anti-doping tribunal – Protection of personal data – Regulation (EU) 2016/679 – Article 5 – Article 6 – Lawfulness of and necessity for online publication of personal data of a person who has acted in breach of anti-doping rules – Article 9 – Whether breaches of anti-doping rules constitute ‘data concerning health’ – Article 10 – Whether breaches of anti-doping rules constitute ‘personal data relating to criminal convictions’ – Whether a national tribunal constitutes ‘official authority’)
I. Introduction
1. Citius, Altius, Fortius; faster, higher, stronger. Like few others, the Olympic motto captures the human desire to advance to new heights. However, the pressure to win may bring the temptation to enhance performance through the use of certain prohibited substances.
2. The present case arises in such a context. The applicant is an Austrian professional athlete. She was found guilty of acting in breach of anti-doping rules. As a consequence, the Austrian national anti-doping authority published her name, details of the breach concerned, and the period of suspension on its publicly accessible website.
3. Is that practice compatible with the General Data Protection Regulation (‘the GDPR’)? (2) That is, in short, the main substantive question raised before the Court. However, as the reference came from a body that is not a ‘classical’ court within the organisation of the judiciary in Austria, this case also raises the issue of admissibility.
II. Background to the case and the questions referred for a preliminary ruling
4. While the use of stimulants to enhance physical performance has been a feature of human competition since the beginning of recorded history, (3) the system of anti-doping controls as we know it dates only from 1999 with the creation of the World Anti-Doping Agency (‘the WADA’) and the entry into force, in 2004, of the World Anti-Doping Code (‘the WADC’). (4) Its latest emanation dates from 2021.
5. Although the WADC is a private legal instrument, its effectiveness is ensured by the 2005 UN International Convention Against Doping in Sport. (5) All the Member States are signatories of that convention. Article 4 thereof states that the provisions of the WADC are not an integral part of the Convention and do not have direct effect in national law. However, by the same provision, the State parties have committed to abide by the principles of the WADC. That commitment, which includes the WADC requirement for online publication of breaches of anti-doping rules, is transposed into the legal systems of the Member States in different ways. (6)
6. The present case comes from Austria, where anti-doping controls are regulated by the Anti-Doping-Bundesgesetz 2021 (2021 Austrian Federal Law on anti-doping) (‘the ADBG’).
7. Between 1998 and 2015, SO (‘the applicant’) was a professional athlete in Austria. The applicant represented her country at international competitions as a member of the Austrian Athletics Federation team. She also carried out management and representative functions at various Austrian sports clubs.
8. In 2021, on the basis of the results of an investigation conducted by the Bundeskriminalamt (Federal Criminal Police Office, Austria), the Unabhängige Dopingkontrolleinrichtung (Independent Anti-Doping Agency, Austria) (‘the NADA’) submitted a request for examination to the Österreichische Anti-Doping-Rechtskommission (Austrian Anti-Doping Legal Committee) (‘the ÖADR’).
9. By decision of 31 May 2021 (‘the contested decision’), the ÖADR found the applicant guilty of breaching Rule 32.2(b) and (f) of the 2015 International Association of Athletics Federations (IAAF) Competition Rules and Articles 2.2 and 2.6 of the 2017 IAAF Anti-Doping Rules. Those rules forbid the ‘use or attempted use of a prohibited substance or a prohibited method’ and the ‘possession of a prohibited substance or prohibited method’. (7) Specifically, the ÖADR found that, between May 2015 and April 2017, the applicant possessed the substances erythropoietin (also known as EPO), Genotropin or Omnitrope and Testosterol (in the form of Androgel) and had used them at least in part in 2015. Those substances were all listed on the WADA Prohibited Lists of 2015 to 2017. They were therefore banned for use by professional athletes operating under the IAAF Competition Rules.
10. As a result of that finding, in the contested decision, the ÖADR declared invalid all the results that the applicant had obtained between 10 May 2015 and the date of entry into force of that decision and revoked all entry fees and/or prize money. It also banned the applicant from participating in sporting competitions of any kind for a period of four years with effect from 31 May 2021.
11. During the procedure before the ÖADR, the applicant had requested that the contested decision not be disclosed to the general public by means of a publicly accessible online publication. That request was rejected by the ÖADR in the contested decision.
12. The applicant submitted a request for review of the contested decision to the Unabhängige Schiedskommission (Independent Arbitration Committee, Austria) (‘the USK’).
13. By decision of 21 December 2021, the USK upheld the substantive findings of the ÖADR and confirmed the applicant’s breaches of the anti-doping rules and the penalty imposed.
14. At the same time, the USK reserved its decision on the applicant’s request that it refrain from publishing the contested decision online, thereby disclosing it to the general public. (8)
15. That publication obligation is based on Paragraphs 21(3) and 23(14) of the ADBG. Those provisions state that the ÖADR and the USK respectively ‘must inform the [Austrian Federal Sports Organisation], sports organisations, athletes, other persons, competition organisers and the general public of its decisions’, stating the name of the person concerned, the duration of the ban and the reasons for it, without it being possible to infer any health data of the person concerned.
16. The publication of this information is mandatory in the case of professional athletes and, in some cases, also for recreational athletes. In other cases, when the breach was committed by recreational athletes, minors or vulnerable persons, publication is not mandatory.
17. While the obligation to inform the public lies with the decision-making bodies, that is to say, the ÖADR and the USK, the ADBG provides that the NADA carries out this task on behalf of the ÖADR and the USK. (9) In order to comply with that obligation, the NADA publishes a table that is accessible to the general public on its website. (10) The relevant entry in that table is composed of the first and last name of the person concerned; the type of sport he or she engaged in; the type of infringement; the type of suspension imposed on him or her; and the start and end dates of the suspension.
18. I understand that this information remains available on the NADA’s website only for the duration of the suspension of the athlete in question.
19. The USK has doubts as to the compatibility, with the GDPR, of the practice of disclosing the applicant’s personal data to the general public by means of publicly accessible online publication on the NADA’s website. In order to be able to decide on the applicant’s request that her personal data not be disclosed on that website, it therefore decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
‘(1) Does the information that a certain person has committed a specific doping violation, as a result of which that person has been banned from taking part in (national and international) competitions, constitute “data concerning health” within the meaning of Article 9 of [the GDPR]?
(2) Does the [GDPR] – particularly in the light of the second subparagraph of Article 6(3) thereof – preclude a national provision that provides for the disclosure of the name of the persons concerned by the decision of the [USK], the duration of the ban and the reasons for it, without it being possible to infer the health data of the person concerned? Is it relevant that disclosure of that information to the general public can only be omitted under the national provision if the person concerned is a recreational athlete, a minor or a person who has contributed significantly to the detection of potential anti-doping violations by disclosing information or other indications?
(3) Does the [GDPR]– particularly in the light of the principles in Article 5(1)(a) and (c) thereof – in any case prior to the disclosure, require a balancing of interests between the personal interests of the person concerned that will be affected by the disclosure, on the one hand, and the interest of the general public in being informed of the anti-doping violation committed by an athlete, on the other?
(4) Does the disclosure of the information that a certain person has committed a specific doping violation, as a result of which that person has been banned from taking part in (national and international) competitions, constitute the processing of personal data relating to criminal convictions and offences within the meaning of Article 10 of the [GDPR]?
(5) If Question 4 is answered in the affirmative: Is the [USK] established under Paragraph 8 of the 2021 ADBG an official authority within the meaning of Article 10 of the [GDPR]?’
20. Written observations have been submitted by the applicant, the NADA, the WADA, the Belgian, French, Latvian, Luxembourg and Polish Governments as well as the European Commission. With the exception of the Belgian, French, Luxembourg and Polish Governments, those parties also presented oral argument at the hearing that took place on 2 May 2023.
III. Admissibility
21. The primary function of the preliminary ruling procedure is to ensure the uniform application of EU law in all Member States. However, although the various national bodies (administrative, regulatory or other types of bodies) are required to apply EU law and might be unsure of its meaning, Article 267 TFEU allows only ‘courts or tribunals’ to seek an interpretation of EU law from the Court. In principle, when a request for a preliminary ruling is received from a national court that is considered to be part of the judicial branch of the government in the respective Member State, the Court will consider the reference to be admissible. However, when such a request is made by a body that does not belong to the judiciary in the classical sense of the word under Article 267 TFEU, the Court will not automatically reject the reference. Instead, it will check whether the referring body might nevertheless be regarded as a ‘court or tribunal’ within the meaning of that provision.
22. The present case has been referred to the Court by the USK. The latter is not one of the bodies that prima facie belongs to the judiciary in Austria. Therefore, in its written observations to the Court, the Commission questioned whether the USK satisfies the requirements in order to be treated as a ‘court or tribunal’ within the meaning of Article 267 TFEU. Accordingly, the first issue the Court needs to resolve before engaging with the substance of this case is whether it can ‘talk’ to the USK at all.
23. I am of the opinion that the USK is a ‘court or tribunal’ for the purposes of Article 267 TFEU. In order to explain my position, I will, first, briefly sketch out the rules governing the organisation and functions of the USK (III.A). Against that background, I will show that it satisfies the conditions developed through the case-law of the Court to be treated as a ‘court or tribunal’ (III.B).
A. The organisation and structure of the USK
24. The USK is a permanent body established in accordance with Paragraph 8 of the ADBG.
25. In its order for reference, that body explains that it functions as the ‘highest’ Austrian sports arbitration tribunal for breaches of the anti-doping rules. It is the superior tribunal in the two-level system for sanctioning breaches of the anti-doping rules established by the ADBG. At first instance, the finding of a breach of the applicable anti-doping rules and the imposition of a penalty is entrusted, on the initiative of the NADA, to the ÖADR. (11) A request for review of a decision of the ÖADR may be brought before the USK. In such a case, the parties to the proceedings are, on the one hand, the athlete (or other person) to whom the decision of the ÖADR applies and the NADA, on the other. (12)
26. The USK makes decisions on the basis of a system of majority voting, (13) in a procedure governed by the Austrian Code of Civil Procedure, (14) and its own Rules of Procedure. The latter are made public. (15)
27. Paragraph 8(1) of the ADBG specifically sets out that the USK is to be independent of public authorities, private individuals and the NADA. It further states that the members of the USK are not permitted to participate in investigations by the NADA of possible breaches of the applicable anti-doping rules; in the final decision of the NADA; in the decision on whether to submit a request for examination before the ÖADR; or indeed in the examination process itself. The USK must carry out its tasks autonomously and independently. (16)
28. According to Paragraph 8(2) of the ADBG, the USK is composed of one chairperson and seven members. The chairperson and his or her deputy must have passed the judicial or bar exam. Two members of the committee must have a law degree and experience in conducting formal investigative proceedings. Two other members must be experts in analytical chemistry or toxicology. Lastly, two members must be experts in sports medicine.
29. The same paragraph also explains that, for each proceeding, the USK is composed afresh: the chairperson or his or her deputy must nominate from among the members of the USK at least one member with a law degree and experience in formal investigative proceedings; at least one expert in analytical chemistry or toxicology; and at least one member who is an expert in sports medicine. (17)
30. According to Paragraph 8(3) of the ADBG and as explained in the order for reference, the chairperson and the permanent members of the USK are appointed by the Federal Minister for the Arts, Culture, the Civil Service and Sport (‘the Minister for Sport’) for a term of four years, with reappointments being permissible. (18) The Minister for Sport may remove a member of the USK before the expiry of their mandate only ‘for serious reasons’ (19)
31. For disputes relating to Austrian sports events or Austrian athletes, proceedings must be brought before the USK. (20) In other words, an appeal against a decision of the ÖADR can, in such cases, only be lodged with the USK. (21)
32. Paragraph 23(3) of the ADBG requires that the USK apply the applicable anti-doping rules of the competent international sports association when reviewing the lawfulness of a decision of the ÖADR. If it finds a decision to be unlawful, it may either annul it, amend it, or replace it by its own decision. (22)
33. As was explained at the hearing, appeals against decisions of the USK may be brought before the competent Austrian civil courts – when they concern civil law matters. In such cases, the USK is not a party to the proceedings before the competent civil court. Rather, the parties continue to be the NADA and the athlete (or other person).
34. However, as was also explained at the hearing and not disputed by either party, the lawfulness of the publication, on the NADA’s website, of the USK decision containing the applicant’s personal data does not appear to fall within the competence of the Austrian civil courts. At the same time, it was also explained that decisions of the USK are not amenable to review by the Austrian administrative courts. Therefore, it seems that in deciding on the lawfulness of a decision to publish an athlete’s personal data, the USK is the last instance of dispute settlement in Austria.
35. An athlete may take a different route, which does not involve the USK, by making a complaint to the Datenschutzbehörde (Austrian Data Protection Authority). Actions against the latter’s decisions may be brought before the administrative courts in Austria.
36. Lastly, and while it is not entirely clear from the information contained in the Court’s file, it appears that an athlete may decide to appeal against the USK’s decision before the CAS, when the complaint concerns matters relating to the correct application of anti-doping rules of the relevant international sports association and/or the WADC. (23)
37. In the light of the above, I will now examine whether the USK is a ‘court or tribunal’ within the meaning of Article 267 TFEU.
B. Is the USK a ‘court or tribunal’?
38. For some time now – since the judgment in Vaassen-Göbbels – the Court has held that the meaning of ‘court or tribunal’ in (what is now) Article 267 TFEU must be resolved exclusively under EU law. (24) That approach permits the Court to hear references for preliminary ruling from bodies which, like the USK, are not considered courts according to the ‘classical’ constitutional division of powers in a Member State between the legislature, the executive and the judiciary, but which are nevertheless endowed with the competence to resolve disputes through the application of EU law. Allowing a wider range of bodies than the courts in the ‘ordinary’ sense to make such references enhances the primary goal of the preliminary ruling procedure to ensure the uniform application of EU law. Thus, from an early stage, the Court has also allowed references from bodies that would not traditionally be described as ‘classical’ ‘courts or tribunals’ . However, the mechanism was not made available to all bodies that must apply EU law, but only to those that can be regarded as ‘courts or tribunals’.
39. The Court has never offered a definition of the concept of ‘court or tribunal’ in Article 267 TFEU. (25) However, it has, over the years, developed a number of criteria which it takes into consideration when determining whether it may admit a reference. Among those criteria are: whether the referring body is established by law; whether it is permanent; whether its jurisdiction is compulsory; whether its procedure is inter partes; whether it applies rules of law and whether it is independent (internally and externally). (26) While those criteria were applied with varying degrees of strictness over the years, recently, possibly under the influence of the rule of law judgments, (27) there has been a strengthening of the requirement of independence. In the judgment in Banco de Santander, (28) for instance, the Court considered it necessary to change its position in relation to the admissibility of references from the Tribunal Económico-Administrativo Central (Central Tax Tribunal, Spain; ‘the TEAC’), considering, unlike several years earlier, (29) that this body does not satisfy the requirement of independence.
40. It is indeed the requirement of independence that is contentious in relation to the USK. Before I explain why I consider that the referring body in this case satisfies that criterion, I will first show that it satisfies other criteria used by the Court in its case-law on the concept of ‘court or tribunal’ in Article 267 TFEU.
1. ‘Established by law’ and ‘permanent’
41. The requirement that the referring body is established by law entails that its legal basis is to be found in national legislation, be that at primary or secondary level. (30) The criterion of permanence requires that, as an institution the body is permanent, irrespective of the fact that it may be composed anew for every proceeding or has a changing composition. (31)
42. In the present case, those criteria are clearly satisfied: as I have explained, the USK is established by the ADBG, the Austrian federal legislation. Its permanent members are appointed for a renewable period of four years, and, even though the composition of the panel responsible for making decisions changes, it is composed in accordance with the rules provided for by law and from the list of standing members of the USK (see points 28 and 29 of this Opinion).
2. ‘Compulsory jurisdiction’
43. The requirement that a referring body has compulsory jurisdiction has been applied in the case-law in two ways. Either the Court has required that the parties to the proceedings before it not be able to choose whether the case should be dealt with by that body (32) or the Court has required that decisions of the body in question be binding on the parties. (33) The compulsory jurisdiction criterion was still considered to be fulfilled where national law granted the parties a choice to appeal to the body in question or to the ‘ordinary’ courts of that jurisdiction. (34) What is important is that the jurisdiction of the referring body does not depend on the agreement of the opposing parties as to whether it has jurisdiction, as jurisdiction is established automatically when one party brings an action.
44. The USK satisfies the criterion of compulsory jurisdiction in both of its uses. It is worth clarifying here that, despite its name, that body is not an ‘arbitration tribunal’ in the sense that its jurisdiction is derived from an agreement between the parties. Rather, as I have explained in points 24 and 31 of this Opinion, and as both the order for reference and the parties explain, in Austria, the USK acts, on the basis of a federal law, as the mandatory instance for requests for review of the ÖADR decisions.
45. Decisions of the USK are binding on the parties to the dispute. Arguably, it is precisely for that reason that the Austrian legislation provides for the possibility of appealing against its decisions on civil law matters to the Austrian civil courts, on the one hand, and on matters of international anti-doping rules, to the Austrian civil courts or to the CAS, on the other. It seems, however, that, under Austrian law, there does not exist a second-instance court to which a decision of the USK on the compatibility with the GDPR of a decision to publish an athlete’s personal data can be appealed. It therefore seems appropriate to consider that body a ‘court or tribunal’ which has, according to paragraph 3 of Article 267 TFEU, an obligation to refer in a preliminary ruling procedure where it considers that the application of the GDPR is unclear when applied to the circumstances of the dispute before it.
3. ‘Adversarial procedure’
46. The requirement for an adversarial procedure is not an absolute criterion. (35) However, there must be a possibility for the parties to be heard, (36) without there being a need for an inter partes hearing. (37)
47. For the purposes of the present proceedings, this criterion, too, is fulfilled: it is clear from the court file that the USK conducted extensive written exchanges of submissions between the parties, as well as two hearings held before the ÖADR in March and May 2021.
4. ‘Decisions based on legal rules’
48. A referring body can be characterised as a ‘court or tribunal’ if it must decide on its ruling by the application of legal rules. That requirement concerns both the substantive rules(38) and the rules governing procedure before the body in question. (39)
49. In the present case, the USK’s decision-making procedure is governed by predetermined substantive and procedural rules. When it reviews decisions of the ÖADR, the USK must apply the relevant anti-doping rules of the ADBG as well as those of the competent international sports association(s) (here, the IAAF and the WADC). (40) As an institution of a Member State, the USK must also apply the relevant EU rules. It is precisely because of that obligation that the USK has decided to refer the present case to the Court to seek an interpretation of the GDPR.
50. In terms of the applicable procedural rules, as described in point 26 of this Opinion, the USK’s procedure is governed by the Austrian rules of civil procedure as well as its own Rules of Procedure. It is required to observe the parties’ rights of defence. (41) Its decision must be given within a predetermined period. (42) Therefore, the USK’s powers are governed by a set of predetermined procedural and substantive rules that it must follow.
5. ‘Independence’
51. When deciding whether the Court should accept the present reference from the USK, the only criterion which may not need to be fulfilled is the requirement of independence.
52. Even if the idea of independence is an inherent element of the judicial function, (43) it was not until 1987 that the Court, in its judgment in X (also known as the ‘Pretore di Salò’ case), (44) held that a referring body has to act independently in order to avail itself of the possibility of entering into a dialogue with the Court in preliminary ruling proceedings.
53. Although independence is a necessary feature for a body to be characterised as a ‘court or tribunal’ as provided for under Article 267 TFEU, when references for a preliminary ruling were being made from a court within the organisation of the established judiciary of the Member States, the Court did not question their independence. Independence was automatically implied. Thus, the question of ‘independence’ was assessed only when the references were being made by bodies not belonging to the judicial branch of the government of a Member State. In those circumstances, there was no need to elaborate on the precise content of the requirement of independence as imposed by EU law. (45)
54. This was the case, until relatively recently, when, due to attempted or implemented legislative changes, the independence of the judiciary was called into question in some Member States. The ‘backsliding in the rule of law’, as it is often referred to, (46) required the Court to explain in much more detail what is understood by the requirement of ‘independence’ of the courts. The relevant judgments, resulting either from infringement proceedings or from requests for a preliminary ruling, (47) raised the question whether Member States’ legislation, on paper and as implemented in practice, offered sufficient guarantees of autonomous and independent decision-making by judges. In deciding on that question, the Court was required to elaborate further on the concept of independence.
55. That line of the case-law opened a discussion (48) relating to the question whether the criterion of independence is (and should remain) the same (i) when the Court decides whether a body is a ‘court or tribunal’ for the purposes of Article 267 TFEU; or (ii) when the Court decides on independence in different contexts, such as alleged infringements of Article 19 TEU by a Member State or in a case involving the independence requirement imposed by particular pieces of EU legislation. (49) In the judgment in Associação Sindical dos Juízes Portugueses, (50) the Court expressly linked the ‘independence’ criterion in Article 19 TEU, Article 47 of the Charter and Article 267 TFEU. The judgment in Banco de Santander might arguably be interpreted as applying the criteria developed in the context of Article 19 TEU to determine the concept of ‘independence’ within the context of Article 267 TFEU. (51)
56. Some authors have expressed concern that linking the case-law relating to Article 19 TEU and that relating to the concept of ‘court or tribunal’ in Article 267 TFEU might remove the option of further dialogue when references are submitted by courts from Member States in which systemic deficiencies in guaranteeing the independence of the judiciary have been found to exist. (52) At the same time, some Advocates General have pointed out that, when it comes to the assessment of independence, the context matters. (53)
57. It is certainly true that the context, or, in other words, the reason as to why the Court assesses the rules applicable to an institution matters. However, I do not see how this automatically entails a difference in substantive standard of independence in each of the different scenarios mentioned. While the way in which the concept of independence in EU law is understood has evolved, this does not necessarily mean that different concepts of independence exist. In my view, the independence requirement is the same for any body seeking to be classified as a ‘court’, whether for the purpose of satisfying the requirements of Article 19 TEU or for the purpose of satisfying those of Article 267 TFEU.
58. Applying the same requirements developed in the cases relating to Article 19 TEU to the assessment of whether a body is a ‘court or tribunal’ under Article 267 TFEU would not, in my view, pose a threat to judicial dialogue under Article 267 TFEU. On the contrary, as I will explain in the circumstances of the present case, such an approach is necessary in order to ensure that by creating specialised bodies with the task of adjudicating on certain limited categories of disputes, the Member States do not circumvent the important requirement of independence which the EU legal order imposes on national judiciaries. Independence ensures a level playing field for the parties to a dispute, in both its internal and external aspects. (54) It is, therefore, a necessary feature of effective judicial protection, this being understood as a fundamental right of every person in every type of dispute that may be resolved by judicial means. This does not mean that the method used by the Court when examining the admissibility of references for a preliminary ruling should change. When the reference comes from a ‘classical’ judicial body, the presumption is still that that body is a court and no further analysis is necessary. It is only if doubts as to the independence of the members of that body are raised by a party to the proceedings, or are otherwise brought to the attention of the Court, that the independence of the referring body must be verified. By contrast, the independence of other referring bodies needs to be proved before the reference can be admitted.
59. As the case-law currently stands, independence has both ‘external’ and ‘internal’ aspects. (55) The former requires that an adjudicator be able to decide autonomously, (56) without being exposed to any external instructions. In order to facilitate this, EU law imposes certain standards relating to the appointment and removal of the members of a ‘court or tribunal’. Even if the adjudicating members of the body concerned may be appointed by an external person or body, including a government minister, after their appointment, they must be free from the influence of that person or body. In that respect, the Court – crucially – requires that the rules preventing removal are anchored in legislative safeguards beyond mere administrative or employment laws. (57) In other words, the persons or bodies appointing members of the ‘court or tribunal’ concerned must be prevented from replacing such members just because they do not agree with their point of view.
60. This does not mean that removal must be entirely impossible or that the persons or bodies appointing such members may not also have the competence to remove them. Rather, the reasons for the removal of a member prior to the end of his or her mandate must be based on ‘legitimate and compelling grounds, subject to the principle of proportionality’. (58) Furthermore, the reasons and the appropriate procedures for such removal must be set out clearly.
61. The members of the USK are appointed by the Minister for Sport for a renewable mandate of four years. (59) Appointment by a minister should not, in itself, present a problem, provided that, after the appointment, members do not owe any loyalty to that minister. That does not seem to be the case here. By virtue of the ADBG, members of the USK cannot take instructions from the government, administrative anti-doping bodies (such as the NADA), or participants in sporting activities. Furthermore, the Court, to date, has not considered the mere fact that a mandate is renewable to be incompatible with judicial independence.
62. In the present case, the Minister for Sport could have an indirect influence on the decision-making procedures of the USK if he or she were able to remove prematurely the relevant members. However, as I have explained, the members of the USK cannot be removed before the expiry of their mandate merely because the Minister for Sport dislikes them or disagrees with their views. Under Paragraph 8(3) of the ADBG, such removal can occur only for ‘serious reasons’. There is no information in the court file as to the reasons that may be classified as ‘serious’. However, when discussing the scope of the Minister for Sport’s powers of removal under the ADBG, the NADA explained that, under Austrian law, few reasons can be so classified. In addition, the applicant suggested that only intentional offences or those punishable by at least a one-year sentence could be classified as ‘serious’. Therefore, the parties seem to agree that the members of the USK cannot be removed at will or at the arbitrary discretion of the Minister for Sport, or any other body.
63. That type of protection against arbitrary dismissal of the members of the USK must be distinguished from the situation of members of the TEAC, which was at issue in the judgment in Banco de Santander. Their removability was possible due to the lack of specific rules laid down in that regard. (60) The absence of such rules manifested itself, as Advocate General Hogan observed in that case, in the fact that members of the TEAC were removed ‘for reasons which seem expedient to the Government of the day’. (61)
64. Lastly, it is also necessary to consider the question of what information the Court should rely on when assessing the independence of the referring body. To my mind, the Court may rely solely on the legislation governing that body. However, if concerns about the practice of the application of such legislation are raised in the proceedings before it, it will be necessary for the Court to assess the relevant circumstances more closely. That being said, in the present case no such concerns have been raised. On the contrary, it has been confirmed that, to date, no recourse has been had to the theoretical power of removal provided for in Paragraph 8(3) of the ADBG. (62)
65. In the present case, I therefore consider that the ‘external’ independence criterion has been fulfilled.
66. That brings me to the second aspect of the independence criterion, the ‘internal’ aspect. This requirement is linked to the impartiality of the body making the reference. (63) It requires that such a body act as an independent third party to the proceedings before it. (64)
67. In short, the adjudicating members must not have any interest in the outcome of the dispute. This, in the first place, means that persons linked to the parties to the dispute cannot sit as members of the adjudicating body. To assess that aspect of independence, it is important to examine the rules applicable to the organisation of the ‘court or tribunal’ in order to verify whether a functional link exists between the dispute-settling body and the administration whose decisions it is reviewing. (65) In other words, the Court must assess whether the roles of the body at issue and that of the administration are clearly distinct, or whether they are conflated. In the latter case, the body in question is deemed insufficiently ‘independent’ from the administration. (66)
68. In this regard, the Commission points to the fact that the USK forms part of the same institutional structure as the NADA and the ÖADR. Specifically, it explains that Paragraph 8(1) of the ADBG states that the USK is ‘established at’ the NADA. Thus, the argument is that the USK stands in judgment of the very institution to which it organisationally belongs.
69. In the light of the information in the case file, I do not consider those objections to be warranted. The Court’s case-law shows that mere institutional links are insufficient, without additional elements, to undermine the independence of the body making the reference for a preliminary ruling. Thus, for instance, in the judgment in MT Højgaard and Züblin, (67) the Court rejected the argument that the Klagenævnet for Udbud (Danish public procurement complaints board) was not independent merely because it shared a secretariat with the Danish Ministry for Business and Growth. Likewise, in the judgment in Dorsch Consult, despite the Commission’s objections that the supervisory board concerned was recognised as being ‘linked to the organisational structure of the Bundeskartellamt [(Federal Cartel Office, Germany)]’, (68) the Court explained that ‘the supervisory board carries out its task independently under its own responsibility’. (69)
70. In the present case, I do not think that the case file or the parties’ observations reveal any indication of a functional interconnection between the USK and the NADA, the ÖADR, the Austrian Government, or any sports federation.
71. Indeed, as I have explained in point 27 of this Opinion, the USK acts independently of the NADA and the ÖADR. As the NADA confirmed at the hearing, the USK has no power to review ex officio the decisions of the ÖADR. By pertinent contrast to the judgment in Banco de Santander, there is also no evidence that the members of the NADA or any sports organisations sit in judgment of proceedings in which they act as parties. (70) Nor has it been alleged that those bodies might influence the functioning of proceedings before the USK in any other way.
72. In the present case, I therefore consider that the ‘internal’ independence criterion has also been satisfied.
73. Lastly, it is necessary to respond to the last concern raised by the Commission relating to the composition of the USK, which – apart from legal professionals – also includes experts in other related fields (chemistry, toxicology and sports medicine). The Court has already admitted references from bodies composed in part of experts in their relevant field, (71) so long as they carry out their duties autonomously. (72) None of the participants in the present proceedings has claimed before the Court that members of the USK who are not lawyers might be subject to external instructions or partial in their decision-making. I do not therefore see the mixed composition of the USK as creating, in itself, any concerns relating to the independence of that body. (73)
6. The USK as the ‘court or tribunal’ of last instance
74. Before I end the analysis of the question of admissibility of the present reference, I would like to propose that the USK is, in the circumstances of this case, not only a ‘court or tribunal’, but also a ‘court or tribunal’ against whose decisions there are no legal remedies, and that it is, therefore, in accordance with the third paragraph of Article 267 TFEU, not merely empowered, but even obliged to make a reference to the Court.
75. As I have explained in points 33 and 34 of this Opinion, some issues decided by the USK may be the subject of an appeal before the Austrian civil courts. However, it appears that the Austrian civil courts are not actually competent to hear questions of law relating to the breach of data protection rules, including the GDPR and the Austrian law on data protection. I presume that this is also what the applicant meant when she asserted that the publication of her data is not subject to judicial review by the competent civil courts.
76. On the other hand, a decision of the USK cannot be the subject of an appeal before an administrative court either. The NADA explained at the hearing that it is the Bundesverwaltungsgericht (Federal Administrative Court, Austria) that is usually competent to hear appeals against public authorities relating to data protection matters. It appears, however, that the ADBG does not provide for the possibility of lodging an appeal before that court against a decision of the USK.
77. If that is indeed the state of Austrian law, the USK would be the sole and final judicial body before which the question of the compatibility with the GDPR of the publication of decisions of the ÖADR or the USK on the website of the NADA may be raised. This would mean that the present reference for a preliminary ruling from the USK represents the only possibility of safeguarding the uniform interpretation of the GDPR in the context of anti-doping proceedings in Austria. Accordingly, in respect of that legal issue, the USK would be assuming the task of a ‘court or tribunal of a Member State against whose decisions there is no judicial remedy under national law’, within the meaning of the third paragraph of Article 267 TFEU.
78. The parallel action filed by the applicant (as well as by a number of other former athletes), first before the Austrian data protection authority and now before the Bundesverwaltungsgericht (Federal Administrative Court) cannot negate the usefulness of the guidance which the Court may provide in the present case. (74) That parallel action is based on an appeal lodged against the decision rejecting a complaint with the competent national supervisory authority, within the meaning of Articles 77 and 78 of the GDPR. However, what the applicant pursues by means of the present reference is a ‘judicial remedy against a controller or processor’, within the meaning of Article 79 of the GDPR. As the Court recently explained in its judgment in Nemzeti Adatvédelmi és Információszabadság Hatóság, the remedies provided for in Articles 77, 78 and 79 of the GDPR must be capable of being ‘exercised concurrently with and independently of each other’, with it falling to the national systems of the Member States to ensure that no inconsistency arises from that concurrent application. (75) It is precisely because that possibility for duality of procedures is provided for in the GDPR itself, and appears to have been implemented as such in Austrian law, (76) that the present case differs from cases where the Court has considered that only one track for requesting judicial protection of EU law rights may be open. (77) In other words, a complaint before the Austrian data protection authority cannot be a substitute for the direct enforcement of the applicant’s GDPR rights before the competent national courts.
79. The Austrian legislature seems to have chosen to establish the USK as the only ‘court or tribunal’ competent to hear claims raised in anti-doping disputes regarding alleged infringements of rights under the GDPR. No other body appears to have such jurisdiction. Because of the procedural autonomy to organise its judicial system, the national legislature certainly can do so. Therefore, to return to my argument that the requirements of independence should be the same in the context of Article 267 TFEU and Article 19 TEU, allowing the USK to meet a lower standard of independence for the purpose of deciding the admissibility issue in the present case would not be in line with the choice of the Austrian legislature to insert that body into its judicial structure.
7. Interim conclusion
80. For the above reasons, I consider that the USK satisfies the conditions to be considered a ‘court or tribunal’ under Article 267 TFEU. The reference should thus be deemed admissible.
IV. Substance
81. In the present case, the applicant challenges, on the basis of the GDPR, a processing operation, by which her name, together with, inter alia, her actions in breach of the anti-doping rule and her resulting suspension, has been placed on the publicly accessible part of the NADA’s website, in the form of an entry in a table of persons breaching the anti-doping rules (‘the processing operation at issue’).
82. As clarified at the hearing, her case does not relate to the two ancillary and connected processing operations of (i) disclosing the same personal data on the NADA’s publicly accessible website in the form of a press release or (ii) distributing said press release by email to a closed, but apparently freely accessible, distribution list.
A. The applicability of the GDPR to the circumstances of the present case
83. The activites challenged by the applicant match the description of the activities to which the GDPR applies: they are (i) the processing of (ii) personal data, which (iii) is wholly or partly carried out by automated means. (78) First, the online disclosure of personal data constitutes ‘processing.’ (79) Second, the processing operation at issue makes use of ‘personal data’: after all, it is the applicant’s name that is the subject of the NADA’s disclosures to the public, together with the penalty imposed on her and the acts in breach of the anti-doping rules at issue. (80) Third, when uploaded on the NADA’s website, the applicant’s personal data passes through a server. That pass-through constitutes processing by ‘automated means’. (81)
84. However, does the GDPR apply to those processing operations in the circumstances of this case?
85. The GDPR was adopted on the basis of Article 16(2) TFEU, the legal basis that empowers the EU legislature to regulate the processing of personal data by the Member States ‘when carrying out activities which fall within the scope of Union law’. The same limit to EU competence is expressed in Article 2(2)(a) of the GDPR, which excludes the application of the GDPR to the processing of personal data in the course of an activity which falls outside the scope of Union law.
86. Advocate General Szpunar has suggested that the ‘scope of Union law’ referred to in Article 16(2) TFEU should go beyond the cases of ‘implementing Union law’ within the meaning of Article 51(1) of the Charter. (82) I agree. It is precisely because the Charter is not meant to increase the scope of the Union’s competences that an express competence to regulate privacy and data protection was included in the text of the Treaty. However, that inclusion did not give the Union a general competence to regulate data processing in the Member States. It was empowered to regulate Member States’ activities only within the scope of EU law. That limit to EU competence expressed in the Treaty and the GDPR itself must be given some meaning. To my mind, if a data processing activity in a Member State cannot be connected (even loosely) with an area covered by EU law, the GDPR does not apply.
87. The processing of personal data for the purpose of implementing a Member State’s anti-doping legislation is not, in my view, an activity that, as EU law currently stands, brings that processing activity within the scope of such law.
88. The European Union does not have competence to regulate sport. This has not changed with the introduction of supporting competence in sport by Article 165 TFEU. (83) Nevertheless, the Court has considered that EU law applies to sport when it is understood as an economic activity. (84) In all the relevant cases, EU primary law has applied to police restrictions on cross-border movements or to competition on the internal market. (85) It is true that national anti-doping rules may be construed as an obstacle to free movement. However, the present case does not concern such a situation.
89. Anti-doping rules primarily regulate sport as sport. They are concerned with sport’s social and educational functions, rather than its economic aspects, even if the former may influence the latter. Nevertheless, even if the European Union lacks regulatory competence in sport, it could theoretically harmonise national anti-doping rules, if this is justified as being necessary to remove obstacles to cross-border movements. However, as the law currently stands, there are no EU rules that relate, even indirectly, to the anti-doping policies of the Member States.
90. In such a situation, I find it difficult to establish the necessary link with EU law in order to consider the circumstances of the present case as a Member State activity which falls within the scope of EU law. I am, therefore, of the view that the GDPR does not apply to the present case.
91. In case the Court considers that the GDPR applies nonetheless, I will now turn to the interpretation of its provisions as requested by the USK.
92. In essence, the referring body is concerned with the following: first, whether Austrian law (the ADBG), which requires that decisions finding a breach of the anti-doping rules be made available to the general public, without any individualised review of proportionality when it comes to professional athletes, is in line with the GDPR; and, second, whether the NADA’s choice to implement that publication obligation by placing data on the publicly available parts of its website is necessary.
93. For this reason, the referring body raises several questions on the interpretation of the GDPR. I consider Questions 2 and 3, which should be dealt with together, to be the most important and complex. I will, therefore, deal with the other questions first, before turning to the legality and proportionality issues raised by the USK.
B. Question 1
94. By its first question, the USK, in essence, wishes to ascertain whether the publication of information that a certain person has committed a specific doping offence constitutes ‘data concerning health’, within the meaning of Article 9 of the GDPR.
95. In my view, the answer to that question can be derived from both the definition of ‘data concerning health’ and the case-law of the Court.
96. As defined in Article 4(15) of the GDPR, ‘“data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.’
97. All the parties, with the exception of the applicant, rightly note that that definition is composed of two elements. The first is the requirement that the personal data at issue be related to the physical or mental health of a natural person. The second is that those data reveal information about the natural person’s health status. In other words, the personal data at issue must not only be somehow linked to the data subject’s health (thus implying a loose connection), but must also allow inferences to be drawn from that information as to the data subject’s health status (thus implying a personalised aspect of the information concerned).
98. In the present case, I am not convinced that the latter criterion, acting as the operative element in relation to the subjective health status of the data subject at issue, is met.
99. Indeed, the finding that the applicant consumed or was in the possession of certain prohibited substances says nothing about her physical or mental health status. Much like the consumption of alcohol says nothing about whether a person suffers from alcohol dependency, the applicant’s consumption or possession of the substances at issue in the present case does not reveal any logical or clear connection to her physical or mental health.
100. Nor do I consider that a different conclusion could be drawn from recital 35 of the GDPR. (86) Its first sentence clarifies, in essence, that the concept of ‘data concerning health’ has no ‘sell-by-date’. Its second sentence then lists the information which could form part of that concept, without however providing any indication that the scope of Article 4(15) of the GDPR should be read differently.
101. While it is of course true that the Court in the judgment in Lindqvist found that the concept of ‘data concerning health’ must be given a wide interpretation, (87) that interpretation was made against the backdrop of the Data Protection Directive, (88) the GDPR’s predecessor, which did not contain a dedicated definition of the concept of ‘data concerning health’. Nor did the Court’s interpretation contain a requirement for a link to be established between the data at issue and the data subject’s health status. As such, while the judgment in Lindqvist may provide some guidance on the interpretation of the term, it certainly cannot override the specific legislative insertion of the Union legislature linking the data subject’s health data to his or her health status. (89)
102. In conclusion, in answer to Question 1, I propose that the Court rule that the information that a professional athlete has committed a breach of an anti-doping rule linked to the use or attempted use or possession of a prohibited substance or method does not, in itself, constitute ‘data concerning health’, within the meaning of Article 9 of the GDPR.
C. Question 4
103. By its fourth question, the USK asks, in essence, whether the public disclosure of the applicant’s name, the breach of the anti-doping rules involved and the penalty imposed on her constitutes the processing of ‘personal data relating to criminal convictions or offences’ within the meaning of Article 10 of the GDPR.
104. The NADA, the WADA and the Belgian, French and Polish Governments contest the classification of the penalties imposed on the applicant as ‘criminal’. On that basis, they conclude that Article 10 of the GDPR is not applicable to the circumstances of the present case.
105. The applicant, the Latvian Government and the Commission, however, claim the opposite. Their case relies, in essence, on the argument that the doping ban imposed on the applicant has a significant personal impact. In their view, the penalty not only entails financial consequences and a relatively significant professional ban, but also indirect consequences arising from the pillorying and stigmatisation that is inherent in the (unrestrained) publication of the applicant’s name, together with the acts in breach of the anti-doping rules and the penalty imposed. That combination is what would make the penalty at issue in the present case ‘criminal’ in nature. On that basis, the applicant therefore further argues that the ÖADR would constitute an ‘official authority’ within the meaning of Article 10 of the GDPR.
106. I agree with the applicant, the Latvian Government and the Commission that, in the present case, the penalty imposed for the breach of the anti-doping rules at issue is of a criminal nature within the meaning of Article 10 of the GDPR.
107. It is clear that the interpretation of either of the two ‘criminal’ concepts referred to in Article 10 of the GDPR (‘criminal convictions’ and ‘criminal offences’) requires an autonomous interpretation. (90) Furthermore, given that both concepts share the same etymological basis (found in the Late Latin word ‘criminalis’), and given that the EU legislature sought to limit the enhanced protection in Article 10 of the GDPR to the criminal sphere alone, (91) the applicability of that provision fundamentally depends on whether the penalty imposed is criminal in nature. (92)
108. To determine whether a penalty is criminal in nature, the Court considers three criteria: first, the legal classification of the offence under national law; second, the intrinsic nature of the offence; and, third, the degree of severity of the penalty that the person concerned is liable to incur. (93) The last two of those criteria arguably hold greater weight. (94)
109. In the present case, it is apparent from the court file that the publication of the information concerning the applicant’s suspension for doping relates to the possession and partial use of prohibited substances. As the Commission explains, and subject to confirmation, the possession and/or use of such substances constitutes a criminal offence under Paragraph 28(1) and (2) of the ADBG. According to the request for a preliminary ruling, the consequences of that offence involve the revocation of titles and forfeiture of prize money, as well as a four-year ban from all (national and international) competitions. It also appears that Paragraph 24(4) of the ADBG prohibits the gainful employment of the applicant by sports organisations during the duration of her ban.
110. As accepted by all parties to the present proceedings, those penalties have the clear purpose of penalising the applicant for her actions as well as acting as a deterrent to her (and other athletes) from engaging in the same conduct.
111. The combination of not only revocation of titles and forfeiture of prize money (correction of unduly obtained past gain) but also an occupational ban for a limited period of time adds a penalising element that dramatically increases the severity of the overall consequence of the applicant’s actions.
112. In other words, the penalty at issue in the present case goes beyond merely seeking to repair the damage caused but has the specific purpose of penalising the applicant for her actions. (95) It also has a preventive function – that of deterring other athletes from committing anti-doping offences.
113. It is this combination of factors that is indicative of an offence that is criminal and goes beyond the threshold of what otherwise would be regarded as a sporting disciplinary offence. (96)
114. This is, of course, as the Latvian Government correctly notes, without prejudice to the national classification of the offences at issue. Nor does this conclusion mean that, in a different set of circumstances, the threshold for finding an individual penalty ‘criminal’ in nature is necessarily reached. (97) However, as I have explained in the previous point, I consider that the particular penalty imposed on the applicant is of such a nature as to reach the threshold of what is considered a criminal conviction or offence for the purposes of Article 10 of the GDPR.
115. Contrary to the WADA’s assertions, I do not think that it would be useful, in general, to regard breaches of anti-doping rules, such as those at issue in the present case, as mere breaches of the (private) rules of individual sporting clubs or organisations. The possession or use of substances in the case of the applicant goes far beyond a potential breach of, say, the constitution of the chess club of Knin (Croatia). (98)
116. Such behaviour is prohibited by national law – the ADBG – and not (only) by the private rules of a club or sports organisation. Furthermore, the indirect effects on the applicant’s personal and professional situation, arising from the social disapproval and stigmatisation that is linked to the finding of a breach of an anti-doping rule, go far beyond the world of sport. (99) Lastly, the fact that the breach of that law may also constitute a disciplinary offence under the rules of a private sporting club or organisation which seek to regulate the conduct of its members (here, the IAAF Anti-doping and Competition Rules) does not prevent the same breach and penalties from also following from the public law of a Member State.
117. For the above reasons, I consider that the processing operation at issue concerns ‘personal data relating to criminal convictions or offences’ within the meaning of Article 10 of the GDPR.
118. What are the consequences of that conclusion?
119. As I have previously explained, a finding that a processing operation falls within the scope of Article 10 of the GDPR requires that the interests of the data subject be given more weight in a balancing exercise on disclosure. (100) By virtue of the wording of that provision, that processing must occur either under the control of ‘official authority’ or under EU or national law providing for appropriate safeguards of the rights and freedoms of the data subject concerned.
120. Accordingly, in response to Question 4, I propose that the Court rule that Article 10 of the GDPR must be interpreted as applying to the processing of personal data relating to the possession and partial use by a professional athlete, in connection with a sporting activity, of substances listed on the WADA Prohibited List.
D. Question 5
121. By its fifth question, which is raised only in the event of an affirmative answer to the fourth question, the USK seeks, in essence, to ascertain whether the processing of the applicant’s personal data relating to her acts in breach of an anti-doping rule makes the USK an ‘official authority’ within the meaning of Article 10 of the GDPR.
122. As I have explained, in the circumstances of the present case, the USK indeed processes ‘personal data relating to criminal convictions and offences’, within the meaning of Article 10 of the GDPR. However, in performing that activity, the USK does not act as the ‘official authority’ that controls the processing of those data.
123. Rather, it appears from Paragraphs 5(6) and 6(1) to 6(5) of the ADBG that the Austrian legislature empowered the NADA to take on the role of ‘official authority’ to, inter alia, control processing activities carried out by the USK in relation to the type of personal data falling within the scope of Article 10 of the GDPR.
124. The substantive responsibility for the correct processing of personal data in the context of the duties of the USK, including publishing the results of its decisions, thus appears to lie with the NADA.
125. Accordingly, the mere fact that the USK processes personal data falling within the scope of Article 10 of the GDPR does not automatically render that body an ‘official authority’ within the meaning of that provision.
126. Therefore, I propose that the Court rule, in response to Question 5, that tasking a body with reviewing a decision finding a breach of an anti-doping rule does not automatically render that body an ‘official authority’ within the meaning of Article 10 of the GDPR, if national law makes another institution responsible for overseeing such data processing.
E. Questions 2 and 3
127. By its second and third questions, which I propose to deal with together, the USK asks, in essence, whether the disclosure to the general public, by means of publication on a publicly accessible website, of a professional athlete’s personal data, together with that athlete’s act in breach of the relevant anti-doping rules and the suspension imposed on him or her, is compatible with the conditions of lawfulness and data minimisation under Article 5(1)(a) and (c) and Article 6(3) of the GDPR.
128. Pursuant to the ADBG, the ÖADR, (101) or, if a request for review of its decision is filed, the USK, (102) must make its final decision on certain breaches of the anti-doping rules available to the public. That information must include the name of the athlete, the sport in which he or she competes, the applicable breach of the anti-doping rules and the resulting penalties. Under Paragraph 5(6)(4) of the ADBG, publication is entrusted to the NADA, which is designated as data controller for that purpose. The ADBG makes that disclosure automatic in the case of professional athletes, and generally optional where recreational athletes are concerned. The ADBG does not itself regulate the modalities of disclosure. Therefore, the choice of publishing on the internet was NADA’s decision alone.
129. The questions referred by the USK raise, to my mind, several issues. First, does the GDPR require a review of proportionality by a data controller in each individual case prior to the disclosure of personal data to the general public, or can the proportionality of said publication be decided in advance by general law? In case of the former, that is to say if an individualised proportionality assessment is necessary, it would appear that the ADBG contravenes the GDPR since the ADBG does not appear to allow for such an individualised level of review. Second, if a review of proportionality may, in principle, be undertaken in abstracto by national law and impose an automatic obligation on the data controller, the second question for the Court is whether the ADBG satisfies the proportionality requirement imposed by Article 6(3) of the GDPR? Third, if the automatic disclosure to the general public of information relating to a decision concerning an anti-doping offence is proportionate to the legitimate aim(s) that the law is trying to achieve, is it necessary to place that information on the publicly accessible website of an anti-doping organisation? I will deal with each of these issues in turn.
1. Does the GDPR require a review of proportionality by the data controller in each individual case?
130. In application of the GDPR, it is first necessary to determine who is the data controller in relation to a particular processing operation. Article 5(2) thereof provides that the controller is responsible for, and must be able to demonstrate compliance with, the principles of data processing as listed in Article 5(1) of the GDPR.
131. According to Article 4(7) of the GDPR, the data controller is a person which determines the purposes and means of the processing of personal data. In the second part of the same provision, it is clarified that ‘where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law’. In the present case, the purposes, but not necessarily the means, of the processing operation at issue are determined by (or at least implied in) the ADBG, which has, at the same time, designated the NADA as data controller.
132. Therefore, the NADA is a controller for the purpose of processing the applicant’s personal data when placing the latter on its website. In my view, this does not prevent the USK from also being qualified as a controller in relation to the same processing operation. (103) After all, according to the ADBG, the NADA is merely fulfilling the USK’s disclosure obligation arising from the ADBG. This might become important if the Court finds (contrary to what I will propose) that a review of proportionality must be conducted by the data controller in each individual case. The question would then arise whether it should be the NADA or the USK who should conduct said review.
133. To be considered lawful, any processing of personal data must, according to the GDPR, be undertaken on the basis of one of the reasons set out in its Article 6. Without trying to explain the difference between Article 6(1)(c) and (e) here, it is common ground in the present case that the NADA would be acting under one, or even both, of those provisions when placing the applicant’s personal data on its website. (104)
134. Where the legal basis for processing is on one of the two provisions I have mentioned in the previous point, Article 6(3) of the GDPR provides that the law that requires processing of personal data, here the ADBG, pursues an objective in the public interest and is proportionate to the legitimate aim pursued.
135. If the legislature has indeed balanced the different interests involved in achieving a certain public interest and decided that certain processing is justified, should the data controller still undertake a separate review of proportionality in each particular case? Or would its obligation under Article 5(2) of the GDPR to demonstrate compliance with the principle of proportionality as expressed in the principle of data minimisation be fulfilled by reference to the obligation imposed on the legislature?
136. In my view, the GDPR does not require that a review of proportionality be conducted in each individual case of data processing by a controller. Rather, the controller may rely – I would even claim that it must rely – on the review of proportionality undertaken by the legislature. A proportionality exercise by the legislature cannot be individualised. However, that exercise may, in the abstract, take account of the data protection interests of a certain group of people and balance them in relation to other social interests involved.
137. Legislation allowing (or requiring) data processing may adopt a different approach. It may permit certain data processing to be carried out if the controller finds it necessary in a predetermined context. In such a case, the proportionality exercise will have to be carried out by the controller in each particular case. However, legislation can also, as in the present case, mandate a certain type of data processing in order to achieve a certain aim. In such a situation, I cannot find any provision in the GDPR which would require, or even allow, the controller at issue to question the review of proportionality undertaken by the legislature. In such a case, the GDPR does not require an additional review of proportionality in each individual case. Of course, the legislature’s proportionality exercise as such may be challenged in the courts by either data subjects, or indeed, data controllers. However, unless it successfully challenges the proportionality exercise of the legislature, the data controller is, in a situation such as that in the present case, under an obligation to undertake the data processing.
138. That type of reading of the GDPR is in line with the principle of democracy and does not contravene the text of that regulation.
139. In a democratic society, it is precisely the task of the legislature to strike the appropriate balance between conflicting rights and interests. Leaving that exercise to an independent, but politically unaccountable institution, even if it is sometimes necessary, is a less democratic solution.
140. Additionally, and as rightfully pointed out by the WADA, making the publication of breaches of the anti-doping rules dependent on the discretionary decision of national anti-doping bodies in each individual case might result in abuse and corruption, especially taking into account the significant interest of athletes, clubs or even governments in preventing such publication. It may also result in inequality of treatment among athletes who, as concerns the commission of anti-doping offences, in fact, find themselves in a comparable situation.
141. Furthermore, the very text of the GDPR allows and even requires that the review of proportionality be conducted by the legislature. Article 4(7) of the GDPR provides for the possibility that the purposes and means of processing of personal data are determined by Union or Member State law, and not by the controller. Article 6(3) of the GDPR requires that the law that enables data processing be subject to a review of proportionality.
142. I am, therefore, of the view that the GDPR does not require that the NADA (or the USK) approve the publication of a breach of an anti-doping rule by professional athletes in each individual case.
143. This brings me to the second issue raised by Questions 2 and 3 – whether the Austrian legislature struck a permissible balance between the different interests involved when it required the applicant’s personal data, together with the applicable breach of the anti-doping rules and the suspension imposed on her, should be made available to the general public.
2. Is the disclosure to the general public required by the ADBG justified?
144. To recap, the ADBG states that the USK (or the ÖADR) must inform the general public of its decisions, stating the name of the persons concerned, as well as the duration of the ban and the reasons for the ban. That obligation concerns primarily, professional athletes, and, in certain instances, recreational athletes. In addition, the ADBG allows for an additional review of proportionality when decisions are made as to whether to publish breaches of anti-doping rules by recreational athletes and vulnerable persons.
145. The applicant questions whether informing the general public is justified in her particular case. The NADA, the WADA and the Commission, as well as the Member States participating in the present proceedings, see no issue with such disclosure.
146. Although there may be additional reasons for doing so, most discussions (in the written and oral parts of the procedure) have focused on two possible justifications for informing the general public: (i) the deterring of anyone who engages in sport from committing an anti-doping rule infringement; and (ii) avoiding the circumvention of suspensions by informing anyone who might sponsor or engage the athlete at issue about said suspension.
147. An assessment of proportionality (105) has to be conducted in relation to each proposed justification. I will, therefore, analyse in turn whether the disclosure to the general public can be justified by one, or both, of the two stated purposes. A review of proportionality in light of each justification comprises several steps. The Court must assess whether the disclosure to the general public is appropriate for achieving the stated goal. If so, the Court still needs to ascertain whether that measure is necessary, which, in turn, requires assessing whether another measure is already available that would achieve the same goal, but would be less intrusive to the data subject’s fundamental right to data protection. Lastly, the Court might consider that the intrusion into the private life of that person was so significant that it could not be justified by the benefit to be achieved by the proclaimed goal.
(a) First justification: prevention through deterrence
148. In my view, making available to the general public the personalised information relating to the breach of an anti-doping rule and its consequences might deter professional and recreational athletes alike from committing similar offences. The measure is also adequate in the preventive sense because it makes young people, who have recently entered into the world of sport and who might want to become professional athletes one day, aware of the consequences of deciding to resort to prohibited substances for better results. I therefore do not have doubts about the appropriateness of the measure at issue for the proclaimed purpose.
149. The more difficult question is whether informing the general public of the name of the individual athlete is necessary in order to deter other athletes from engaging in similar breaches of the anti-doping rules themselves. In that respect, it is worth taking into account the opinion of the Article 29 Data Protection Working Party (‘the Article 29 WP’), the predecessor of today’s European Data Protection Board, in which it examined the proportionality of similar rules of the WADC. (106) The Article 29 WP considered, for the purposes of deterring other athletes, that it would be sufficient to publish anonymous information about breaches and penalties. (107)
150. I do not agree. It is true that a deterrent effect exists already because of the severity of the penalties concerned. However, the knowledge that one’s name may be published in relation to the breach of an anti-doping rule has an additional and stronger deterrent effect. Whereas a young athlete trying to make a career may calculate that the risk might be worth taking if the expected penalty is a few months’ or even a few years’ suspension, he or she might think twice once he or she realises that the general public will learn about his or her offence. Anonymous publication cannot, therefore be seen as a measure that achieves the same goal equally effectively. (108)
151. The Article 29 WP also considered that a one-off publication immediately following a decision confirming the breach of an anti-doping rule might be an adequate, yet less restrictive measure. I disagree also on this point. The availability of information throughout the duration of the suspension has a better chance of reaching the targeted public. Additionally, I do not see how the publication of, for example, a single press release on the internet would be less intrusive than the publication of a table containing the same information. Such a press release might, in fact, remain available for much longer than the table exposing the suspended athletes, as the latter would be removed upon expiry of the suspension. It is true, as pointed out by the applicant, that if suspension is for life, the table entry at issue also stays online for life. However, provided that it contains accurate information, this type of interference with the data subject’s right to data protection is not overly harsh (even if one may question whether suspension for life is excessive, but that is a different issue), whereas the benefit of deterring young athletes by making them aware of such a possibility cannot be understated. In any event, in the present case, the suspension lasts for four years, after which the applicant’s personal information in the table at issue will be removed.
152. Lastly, one may ask the following: whether it is necessary to publish every anti-doping offence; whether only the more severe breaches should be made known to the public; whether only repeat offenders should be exposed by name; and whether one should take into consideration the level at which athletes compete or other, additional factors?
153. In my view, it is necessary to leave the legislature a certain margin of discretion in assessing such factors. It might be, for instance, that publishing only some breaches would make the decision to commit other breaches easier. Publishing only repeat breaches might enter into the calculations of young athletes, who may decide that the risk is worth taking once, as their names will not be made public for a single offence. (109) There are multiple concerns and arguments that can be raised.
154. The Austrian legislature seemed to have taken into consideration different concerns in order to achieve the preventive goal of deterring possible breaches of the anti-doping rule. Its balancing of the interests at issue resulted in some exceptions and limits to the rule, which was obviously found not to detract from the desired goal. It excluded minors, vulnerable persons and, in most cases, recreational athletes. No convincing argument has been put to the Court that would allow it to second-guess the legislature’s evaluation that the rule at issue was necessary for preventive purposes in the case of professional athletes.
155. I am, therefore, of the view that the measure requiring personalised disclosure to the general public of the anti-doping offences committed by professional athletes is adequate and necessary for deterring current and future athletes from committing such offences.
156. Lastly, the interference with the rights of professional athletes is not so significant that it could not be justified by the preventive aim of the measure at issue. What is published is the name of the athlete, the sport in which he or she participates, the breach of the anti-doping rules committed and the duration of the resulting suspension. That information does not reveal anything beyond the professional life of the athlete in question, and simply states the consequences of the illegal behaviour which were already known to the athlete when he or she decided to commit the offence in question.
(b) Second justification: prevention of circumvention of a suspension
157. The other justification which has been suggested in the course of the present proceedings is the need to inform the relevant stakeholders that the athlete in question cannot participate in any type of engagement related to any sport for as long as the suspension is valid. In that way, the effectiveness of the penalty and the prevention of its circumvention is achieved.
158. Publicly accessible publication is certainly adequate for the purpose of informing persons who may wish to sponsor an athlete, invite the athlete to compete in an organised competition, or employ the athlete in any capacity related to sport. For this reason, those stakeholders need to know about the athlete’s suspension. Therefore, the measure provided by the ADBG is adequate for the stated purpose.
159. Here too, the more difficult question is whether such a measure is necessary.
160. Any arguments relating to anonymisation cannot be placed in the context of this public aim. In order to inform targeted stakeholders, it is necessary to state the name of the suspended athlete.
161. Invoking the opinion of the Article 29 WP, the applicant, however, considers that, for the stated purpose, it is not necessary to inform the general public. It would be sufficient to inform sports organisations and potential or current sponsors. In response, the WADA and the NADA contend that it is impossible to know in advance whom to inform. Additionally, at any moment a new stakeholder might become the target of such information, for example the owner of a newly established gym.
162. The Article 29 WP has proposed a potentially less far-reaching measure which could prevent circumvention of a suspension based on the introduction of a ‘certificate of good character’. (110) I understand that proposal to relate to a procedure in which, before inviting a person to participate in competitions, offering someone employment in sport, or deciding whether to sponsor an athlete, competition organisers, potential employers and sponsors would request such a certificate to be produced by the athlete in question. In order to perform its function, that certificate would have to be provided at a global, international level and would, therefore, involve different data processing issues, such as the transfer of those data to an international organisation. In any case, such a system does not exist at the present time. As a message to the WADA to consider introducing such a system, the Article 29 WP’s suggestion might have some weight. However, for as long as that system is not instituted, the Austrian legislature cannot use it as a less restrictive measure to inform interested stakeholders.
163. Given that targeted information is not efficient, as one may not know who might need such information, and that an adequate system of certificates of good character does not currently exist, I am of the view that the measure at issue is both appropriate and necessary for achieving the goal of preventing circumvention of the suspension.
164. It is possible to add another argument to the foregoing, as raised by the NADA at the hearing, that engaging the suspended athlete in itself represents a breach of the anti-doping rules. (111) Therefore, an awareness of the situation concerning suspended athletes also seems necessary in order to avoid possible indirect breaches of the anti-doping rules.
165. Lastly, the table containing the names, acts in breach of the anti-doping rules and suspensions of athletes that is published on the NADA’s website is periodically updated. Information is removed upon expiry of the suspension concerned. This means that the applicant’s personal data will not stay on that website for any longer than is necessary to prevent the circumvention of her suspension.
3. Does publication on the internet make a difference?
166. The ADBG requires that the requested information be disclosed to the general public, but it does not specify the method by which this must be done. It was NADA’s decision to place the information at issue on its website.
167. The applicant has challenged that decision, considering that online publication on the internet is too intrusive and that offline publication or, at least, the introduction of a login and password system for accessing the published information, would represent measures that interfere less with athletes’ fundamental rights.
168. The idea that publication on the internet is too intrusive has been stated by others, for example, by the Article 29 WP (112) or the dissenting minority in the judgment of the European Court of Human Rights in L.B. v. Hungary. (113)
169. I can be very brief in that respect. If the obligation to make information which includes personal data available to the general public is found to be justified, the only way for that obligation to be fulfilled in modern society is by publication on the internet. Just as no one would ask a person to go from door to door announcing news items after the invention of the printing press by Gutenberg, with the advent of the internet, print publication (such as, for instance, a newsletter) is no longer an adequate means of making information available to the general public. Asking for offline publication amounts to asking for permission to circumvent the obligation to inform the general public.
170. In its Opinion 4/2009, the Article 29 WP stated that publication on the internet is considered more intrusive than publication by offline means. (114) Its primary argument was that the former means that anyone can consult the data. This is true, but that is precisely the idea behind the requirement that information be made available to the general public. The second argument put forward by the Article 29 WP concerned the fact that information on the internet can be used for other purposes and be further processed. It is true that it is easier to reprocess information that is already on the internet. However, ultimately, there is no difference between the possibility of repurposing information which is placed on the internet or that of repurposing information which is printed in a newsletter. Information about anti-doping infringements published in a newsletter is just as capable of being used by, for example, journalists and of being placed on an online news portal.
4. Interim conclusion
171. I am, therefore, of the view that the mandatory publication of the breach of applicable anti-doping rules by a professional athlete on the publicly accessible website of an anti-doping authority is both adequate and necessary for achieving the preventive function of deterring present and future athletes from committing a similar breach of those rules as well as for preventing the circumvention of suspensions by athletes.
172. On the basis of the above, I propose that the Court answer to the second and third questions to the effect that Article 5(1)(c) and Article 6(3) of the GDPR do not preclude the practice, by a national authority responsible for promoting, coordinating, and monitoring a national doping control programme, of disclosing, on its website, in a publicly accessible manner, the personal data of a professional athlete in relation to a breach of an anti-doping rule.
V. Conclusion
173. In the light of the foregoing, I propose that the Court of Justice answer the questions referred by the Unabhängige Schiedskommission (Independent Arbitration Committee, Austria) as follows:
(1) The information that a professional athlete has committed a breach of an anti-doping rule linked to the use or attempted use or possession of a prohibited substance or method does not, in itself, constitute ‘data concerning health’, within the meaning of Article 9 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
(2) Article 5(1)(c) and Article 6(3) of Regulation 2016/679
must be interpreted as not precluding the practice, by a national authority responsible for promoting, coordinating, and monitoring a national doping control programme, of disclosing, on its website, in a publicly accessible manner, the personal data of a professional athlete in relation to a breach of an anti-doping rule.
(3) Article 10 of Regulation 2016/679
must be interpreted as applying to the processing of personal data relating to the possession and partial use by a professional athlete, in connection with a sporting activity, of substances listed on the World Anti-Doping Agency Prohibited List.
(4) Tasking a body with reviewing a decision finding a breach of an anti-doping rule does not automatically render that body an ‘official authority’ within the meaning of Article 10 of Regulation 2016/679.
However, that is the case so long as control by a body designated as such is otherwise assured under national law.